Shopify MCP — Universal, Read-Only

A single MCP server exposing 100% of the Shopify Admin GraphQL API read surface (version 2026-04) through 6 universal tools. Read-only is enforced at the query-parser level — mutations are rejected before they ever reach Shopify, not merely discouraged. Multi-store by design: one server instance can serve many shops.

Built and maintained by Scalably. Runs on the Model Context Protocol. License: MIT.

Why read-only at the parser level? Giving an AI agent write access to a live store is how you end up with a deleted product or a wrong-priced variant. This server enforces read-only by parsing every query and rejecting mutations before they leave the process — not by trusting the model to behave, and not by relying on Shopify-side scopes alone. It's the safety boundary an agent in production actually needs. (more on the pattern)

Quick start

pip install -r requirements.txt

# Single store (simplest)
export SHOPIFY_DOMAIN="my-store.myshopify.com"
export SHOPIFY_ACCESS_TOKEN="shpat_..."   # or SHOPIFY_CLIENT_ID + SHOPIFY_CLIENT_SECRET
python server.py

Then point any MCP client at the server. See Authentication below for multi-store and OAuth client-credentials setup.

Tools (6)

Every non-list tool takes an optional shop argument (alias or domain). Required when >1 store configured; auto-selected when exactly 1.

Coverage

100% of Admin GraphQL API read surface — any object, field, or connection accessible with the token's scopes is reachable via shopify_graphql_query. Anything large-scale (>10k records) should use shopify_bulk_query. Analytics goes through shopify_shopifyql.

Authentication

Multi-store (preferred for agency setups)

Set SHOPIFY_STORES to a JSON object mapping alias → store config:

{
  "main":   {"domain": "my-store.myshopify.com",        "client_id": "...", "client_secret": "..."},
  "outlet": {"domain": "my-store-outlet.myshopify.com", "client_id": "...", "client_secret": "..."},
  "legacy": {"domain": "legacy-store.myshopify.com",    "access_token": "shpat_..."}
}

• Each store can use EITHER client_id+client_secret (Dev Dashboard OAuth, 24h tokens auto-refreshed per store) OR access_token (legacy shpat_).
• Aliases: [a-z0-9][a-z0-9_-]{0,63}. Lowercase-normalized on load.
• Token cache is per-store-domain; one throttled store doesn't block others.

Single-store (backward-compat)

If SHOPIFY_STORES is unset, the MCP falls back to single-store env vars:

• SHOPIFY_DOMAIN or SHOPIFY_SHOP_DOMAIN — <shop>.myshopify.com
• Auth path A: SHOPIFY_CLIENT_ID + SHOPIFY_CLIENT_SECRET (Dev Dashboard)
• Auth path B: SHOPIFY_ACCESS_TOKEN (legacy shpat_)

The single store registers under alias default — callers can omit shop argument on tool calls.

Read-only enforcement

Every query is parsed with graphql-core before transmission. The parser rejects:

• subscription operations (not supported by Admin API anyway)
• Any top-level mutation EXCEPT bulkOperationCancel (cancels an in-flight bulk job, no shop-data write)
• M

... View full README on GitHub